Commit ad993a95 authored by Xie Yongji's avatar Xie Yongji Committed by Jakub Kicinski
Browse files

virtio-net: Add validation for used length 



This adds validation for used length (might come
from an untrusted device) to avoid data corruption
or loss.

Signed-off-by: default avatarXie Yongji <xieyongji@bytedance.com>
Acked-by: default avatarJason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20210531135852.113-1-xieyongji@bytedance.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent e099f3e8

drivers/net/virtio_net.c

+13 −7
Original line number Diff line number Diff line
@@ -730,6 +730,12 @@ static struct sk_buff *receive_small(struct net_device *dev, 
	len -= vi->hdr_len;

	stats->bytes += len;



	if (unlikely(len > GOOD_PACKET_LEN)) {

		pr_debug("%s: rx error: len %u exceeds max size %d\n",

			 dev->name, len, GOOD_PACKET_LEN);

		dev->stats.rx_length_errors++;

		goto err_len;

	}

	rcu_read_lock();

	xdp_prog = rcu_dereference(rq->xdp_prog);

	if (xdp_prog) {
@@ -833,6 +839,7 @@ static struct sk_buff *receive_small(struct net_device *dev, 
err_xdp:

	rcu_read_unlock();

	stats->xdp_drops++;

err_len:

	stats->drops++;

	put_page(page);

xdp_xmit:
@@ -886,6 +893,12 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, 
	head_skb = NULL;

	stats->bytes += len - vi->hdr_len;



	if (unlikely(len > truesize)) {

		pr_debug("%s: rx error: len %u exceeds truesize %lu\n",

			 dev->name, len, (unsigned long)ctx);

		dev->stats.rx_length_errors++;

		goto err_skb;

	}

	rcu_read_lock();

	xdp_prog = rcu_dereference(rq->xdp_prog);

	if (xdp_prog) {
@@ -1012,13 +1025,6 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, 
	}

	rcu_read_unlock();



	if (unlikely(len > truesize)) {

		pr_debug("%s: rx error: len %u exceeds truesize %lu\n",

			 dev->name, len, (unsigned long)ctx);

		dev->stats.rx_length_errors++;

		goto err_skb;

	}



	head_skb = page_to_skb(vi, rq, page, offset, len, truesize, !xdp_prog,

			       metasize, !!headroom);

	curr_skb = head_skb;